It’s not the news you want to hear, but it’s important nonetheless. Amazon revealed just before all of the Black Friday shopping hubbub that it has accidentally revealed the email addresses of some users. Unfortunately, there is not much else that we know about this, but anyone who received email from Amazon about this should take notice and not simply ignore it.

The number of users has not been disclosed and not much else about this has either. We don’t know how it happened. The only thing Amazon did say is that it was due to a technical error and that it has been fixed. They also wrote in a notice to affected customers that there is no need to change passwords, as those were not included in the revealed data.

However, they are being rather secretive about this whole issue, so it’s probably not a bad idea to change it anyway. Make sure to include:

Upper and lowercase letters

At least one number

At least one special character

If you did or didn't get a notification, watch for phishing emails. Phishers love a good reason to crank out a new campaign. If something like this hits the news, scammers are right there to capitalize. Remember never to click on links that come from unknown senders, are unexpected, no matter who the sender is, and that go to a location that doesn’t make sense. To determine this last bit, let the mouse pointer hover over the link for a couple of seconds and it’ll show where it’s headed. If you’re on a mobile device, hold down on the link for several seconds and it will bring up the entire link too. If you think you’re going to Amazon, but the link goes to some other place that you cannot be sure about, skip it. Either type in the address of where you think it should go (Amazon, in this case) or use a previously safely bookmarked link.

Remember to look for the telltale signs of phishing in your email messages:

Typos and grammatical errors

Misuse of the language in which the message is written

Unprofessional verbiage

Generic greetings such as “Dear User”

A sense of urgency to click a link or something “bad” will happen

Because Amazon’s name is used in phishing email rather often, go directly into your account to verify details, change your password, or check on orders. Don’t click links in the messages that say they’re from Amazon. It’s just safer that way.

Who doesn’t like efficiency? The good news is that Windows and Linux users may get to experience it soon. The not so good news is that the experience may be as part of an “all-inclusive” bit of malware. It packs not just a one-two punch, but more! It can mine cryptocurrency, execute ransomware, become a botnet, and self-propagate. And it’s all wrapped up in a nice little package.

Researchers at Palo Alto Networks found Xbash lurking around and believe that the Chinese speaking Iron Group (also known as Rocke) has their grubby hands in it. Besides the above capabilities, it has some yet-to-be functionality that can allow it spread very quickly once it’s in a network.

Xbash scans for open ports using a dictionary of weak usernames and passwords. Then it initiates a brute force attack. Once it finds vulnerabilities, it deletes databases and issues the ransom note.

There are a lot of terms in there, so let’s make it more understandable.

What is a bot?

It’s short for web robot. It’s a software app that performs automated tasks via the Internet. There are good and bad bots. For example, Amazon’s Alexa is a bot, as is Microsoft’s Cortana. But there are also bad ones, like Mirai.

What is a botnet?

The simple description is a number of connected devices that is running multiple bots. It can perform denial of service attacks (DOS), steal data, and distribute malware and spam en masse. The attacker has access to all of the connected devices.

What is ransomware?

It’s malicious software (malware) that can take over a device, encrypt data, and demand payment in some form from the victim. The attackers that use ransomware will often say they’ll give you the key to decrypt your data after you pay up, but they usually don’t, and/or the keys don’t work. That’s why it’s not recommended that you pay the ransom.

What is cryptocurrency?

It’s all the rage. It’s unregulated digital currency. Its value goes up and down like stocks. There is no central server or authority. It’s essentially a peer-to-peer monetary system. Transactions are confirmed by every cryptocurrency holder before they are deemed legitimate. This is all done digitally, of course and it takes a lot of energy resources to do this. That’s why it uses other machines to “mine” it. The mining is the digital verification of the transactions and it can slow systems and deplete batteries on mobile devices in a hurry. As a result of doing the work of mining, the miner is rewarded with the digital currency. That’s their “free money.”

Xbash can really do damage. Users should follow some basic cybersecurity guidelines to avoid it:

Keep all systems updated with patches. This will help keep those holes that malware like this likes to find, plugged.

Make sure all passwords are unique and are strong. This means they should be at least eight characters, have upper and lowercase letters, include numbers and special characters. They should not be actual dictionary words either, but something that can’t be easily guessed and used in a brute force attack.

Perform regular backups of important systems and data. This will allow a restore to be done in case ransomware hits.

Ensure all systems have anti-virus installed and it’s kept updated.

Researchers estimate that Xbash has collected about $6,000 from 48 victims for the group thus far, as a result of the ransomware. However, it’s unknown if the money paid actually resulted in data recovery for the victims. The norm is that it isn’t. Instead of paying the ransom, make sure those backups are completed, stored off the network, and easy to retrieve.

Businesses in the US are slowly realizing the need for employee education to prevent cyberattacks like ransomware and other devastating malware that start with phishing emails. However, for email scammers targeting organizations, the slower the education, the better. Also, employers with a BYOD (Bring Your Own Device) policy are at increased risk of hacking should their employees have poor personal email safety habits. As the financial cost of phishing attacks against businesses of all sizes continues to grow, so does the need for employees to be aware and be on the lookout for email phishing.

Recent cost figures vary – from the lowest being $1.6 million, to a projected cost by Juniper Research ringing in at $150 million by the year 2020. No matter how you slice it, the cost of phishing attacks for any size organization is huge, and one from which not all recover. According to Webroot Threat Report, an estimated 1.5 million new phishing sites pop-up each month. That’s bad news for companies and consumers alike, but it shines a spotlight on just how important it is for employees to be ready to spot bogus emails, starting with the subject lines.

Just last month, Webroot’s “The 2018 Webroot SMB Pulse Report” finds email phishing the top security threat to SMB’s (Small-to-Medium-Size Business). Of the 500 SMBs surveyed, 24% stated this fact. The same percentage weren’t sure of their number one threat. However, companies that had between 20 and 99 employees thought naiveté held that spot, with only 22% thinking it was phishing.

Employee awareness is proving to be key to stopping email phishing attacks. The report finds overall the following email subject lines the top to look for this year, warts and all.

Review or Quick Review

Bank of ; New Notification

Charity Donation for You

FYI

Action Required: Pay your seller account balance

Unauthorize login attempt

Your recent Chase payment notice to

Important: (1) NEW message from

AMAZON : Your Order no #812-4623 might ARRIVED

Wire Transfer

Assist Urgently

This list shows that although hackers may not be the best at constructing subject lines, they do know how to get at the heart of the matter by preying on human emotions. Phishing risks involving a company and its employees, is costly in many ways. One opened bogus email and one click on an attached link can put the future of an entire company at risk. Not only are there financial repercussions involved, but the loss of consumer confidence can prove most costly of all. Ongoing education for employees alerts them to look for suspicious email subject lines and unknown, suspicious, or unexpected senders as the first line of defense. Other awareness training includes checking for bad spelling and grammar and overall, unprofessional appearance.

No matter what size company, hackers are only too happy to take advantage of unsuspecting and trusting employees through email phishing. An aware, educated employee may well be one of the most important assets a business can have for their continued success.

Credential Stuffing Key Reason To Have Unique Passwords For Every Account

Published August 31, 2018

Did you hear it was Amazon Prime Day not long ago? If you didn’t, it really caused some people to be frustrated. In fact, many comments were posted on Amazon’s Facebook page about hurried consumers who couldn’t purchase their coveted prizes during this time because the website was slow, crashed, or just did something to prevent them. Well, according to a report from the security firm Shape Security, hackers may have helped cause the problems.

Ok, the report (2018 Credential Spill Report) by Shape Security didn’t explicitly blame hackers for that, but they did find that 90% of all login attempts at online shops are by cybercriminals.

Some key findings from the research:

More than 2.3 billion, yes with a “b” usernames and passwords were “spilled” from 51 organizations last year.

The banking industry in the U.S. loses nearly $50 million per day from credential stuffing attacks.

It takes some time to discover credential spills; An average of 15 months in fact.

What is a credential spill? Well, Shape defines it in the report as “an incident in which a set of usernames and passwords from an organization become compromised.” Hackers use these username and password combinations to attack all kinds of sites, knowing that many users re-use these credentials across multiple websites; even between online shopping and their financial accounts. That’s really a big no-no. Hackers will take these combinations and do a process called “credential stuffing.” They test them on every website they can think of until they succeed. This happens more often than you’d think and far more often than it should.

That’s why security professionals keep going on and on about having unique credentials for every website. It truly is important.

Frequent flyer and award systems are also targeted for this. Hilton loyal customers experienced this a few years ago. And Shape also claimed some hackers will use grocery login credentials to order expensive cheese on the user's dime and resell it to restaurants.

So, follow good login credential practices. Create unique and strong passwords for every site and you can keep the hackers’ grubby fingers off your high-priced cheese.

In October 2017, Amazon announced its “Amazon Key” service just in time for the holiday shopping craze. In a perfect world, this service allows Amazon delivery drivers to open your front door and leave your package just inside your home, securely locking the door after them. According to security researchers and a few enterprising hackers, that’s not always the case. They’ve discovered ways to disable Amazon Key safety features, particularly the camera function and door lock. It literally opens the door to having your house ransacked by rogue drivers or tech savvy thieves.

Cloud Cam

Amazon Key has a camera aimed at the inside of your front door. The customers have an app named Cloud Cam, giving a live feed to their remote device. The idea is they see their door opening for a delivery, see their package tucked safely inside by the driver, and see the door closed and locked behind them. What could possibly go wrong with a real time delivery camera? It’s simple – the camera is frozen in time. The customer sees the door closed when it’s actually wide open. But, having a thief run amok in your home while you’re seeing and believing your front door is still closed and locked is an unnerving prospect.

Amazon Key Lock

One big safety feature of Amazon Key is the door lock itself. It’s also been proven that when Cloud Cam has been frozen and disabled, the Key lock on the door is also disconnected. As if that’s not scary enough, a separate attack can be done on the lock itself without disabling Cloud Cam. Just as the driver is closing the door to leave, a hacker following the delivery route sends a command knocking the Key offline. The closed door stays unlocked for the hacker, opening a world of hurt to you and the package that started it all.

Amazon Fights Back

In defense of their Amazon Key service, a spokesperson said “Every delivery driver passes a comprehensive background check that is verified by Amazon before they can make in-home deliveries, every delivery is connected to a specific driver, and before we unlock the door for a delivery, Amazon verifies that the correct driver is at the right address, at the intended time…” About the lock hack, they claim protocol is after “several minutes” of a lock being open, their app notifies the driver and the home dweller that something is amiss.

Shortly after Amazon was notified about their Key service vulnerabilities, announced they would be deploying an update that will “more quickly provide notifications if the camera goes offline during delivery.” Let’s hope that update works because this year, Amazon is set to offer their Key services to other businesses like Rover dog walking, Merry Maids cleaning service, and more. What else can be said for now but “buyer beware!”

Twenty million or more homes now entertain a smart-speaker sidekick. Speaking to devices isn’t new, just ask Alexander Graham Bell. But with technology constantly building on top of itself, these little household helpers are now leading the way. With all of their novelty and support, there is a flipside of voice-activation. From casual users to strung-out parents (who kiss the counter it sits on), there are several areas of concern.

Although the devices are trained to recognize the voices of users and family members, it’s far from 100% foolproof. Advertisers are already using voice-activation in TV and radio ads. While you’re cooking dinner, your kids might have a different idea and order a continuing stream of pizza deliveries. A more nefarious character could ask for personal information or turn on the shopping option for a lucrative shopping spree.

Privacy violations are cropping up primarily because once the device is activated, it records what’s being said and in some cases, uploads that data to a server elsewhere.

Earlier this year, Amazon was asked to give up an Echo device to the authorities concerning a murder case. Law enforcement believed the Echo may have inadvertently recorded information about the crime. Amazon relinquished the device, but not without protest. To be expected, voice-activated data vulnerability and privacy invasion hasn’t gone unnoticed by hackers. As smart-speakers grow in popularity, the more smarts you’ll need to protect yourself.

Always link your smart speaker to your home or office Wi-Fi network. Having it attached to a public Wi-Fi hotspot could spell disaster.

Using strong passwords with two-factor verification is always smart for any device. Smart-speaker voice-activation is no different.

Connect only necessary accounts. When a linked email device is compromised, it can be used to spy. Linking banking and other financial information is playing with fire. The more sensitive the account linked the more vulnerable it is.

Turn off the microphone for the device. It may not be convenient remembering to turn it back on, but you’ll know your privacy is certain when you’re not using it.

Hackers who gain access to the local network can change device settings or remove settings completely. Once they’re in the network, a whole lot of hurt can follow. Make sure you’re not making it easier for them.

We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.

Chances are pretty good that you have heard the term business email compromise or BEC by now. It is a type of wire transfer fraud that the FBI has deemed one of the most prevalent types of scam going around these days. In 2017, there were over 15,690 complaints that resulted in total adjusted losses of more than $675 million. That is an 87% increase over 2016 and it is expected to continue to rise. The Identity Theft Resource Center (ITRC) reported that of the fraud related complaints reported in 2017, the most common type was wire transfer fraud.

Chances are pretty good that you have heard the term business email compromise or BEC by now. It is a type of wire transfer fraud that the FBI has deemed one of the most prevalent types of scam going around these days. In 2017, there were over 15,690 complaints that resulted in total adjusted losses of more than $675 million. That is an 87% increase over 2016 and it is expected to continue to rise. The Identity Theft Resource Center (ITRC) reported that of the fraud related complaints reported in 2017, the most common type was wire transfer fraud.

This Privacy Policy applies to and is provided on behalf of Stickley on Security. (collectively referred to as "We", "Us", or "Our") and describes Our information gathering
practices and policies in connection with this Site. We value your ("User", "You", or "Your") privacy and recognize the sensitivity of Your personal information. We are
committed to protecting Your personal information and using it only as appropriate to provide You with the best possible service, products, and opportunities. Use of this
Site constitutes consent to Our collection and use of personal data as outlined herein.

COLLECTION AND USE OF PERSONAL INFORMATION FROM SITE USERS

We collect personally identifiable information from Users who provide it to us for billing purposes. For example, We collect Your name, street address, city, state, zip
code, telephone number, email address, and financial information, such as a credit card number, if You use the Site to register or renew a license. We may use this
information to contact You regarding the status of Your account and orders placed, and to alert You to new information, products and services, events and other
opportunities. We recognize that You may wish to limit the ways in which You are contacted and provide You with opt-out options below. Information about Our experiences and
transactions with you, such as your payment history, types of services and/or products you purchased are not shared with organizations outside of Stickley on Security.

We will not disclose to third parties (that is, people and companies that are not affiliated with Us) individually identifying information, such as names, postal and e-mail
addresses, telephone numbers, and other personal information, except to the extent that it is necessary to process and provide You with Your order, license request or
other request. Your contact information may also be provided to the extent necessary to comply with applicable laws or legal processes (e.g., subpoenas), or to meet contractual obligations outlined in this policy, or to protect Our
rights or property. We will cooperate with all law enforcement authorities.

If Your order, license request or other request is processed by a third-party, or if You are provided with bulletin boards and chat rooms and/or email capabilities on
this Site, please note that in the event that You voluntarily disclose personally identifiable information in those instances, that information, along with any substantive
information disclosed in Your communication or post, can be collected, correlated and used by third parties. This may result in unsolicited messages from third parties. Such
activities are beyond Our control, and We encourage You to check the applicable privacy policy of such party when providing personally identifiable information.

For each visitor to this Site, Our server can detect and collect certain information, including the User's domain name and e-mail address, and can identify the Web pages the
User visited or accessed. We may use this information in order to measure interest in and use of the various areas of the site.

We do not knowingly solicit information from children and We do not knowingly market the Site or its services to children.

OPT-OUT

You may at any time opt out of having Your personal information used by Us to send You promotional correspondence by contacting Us via e-mail provided in the "Contact Us"
section below.

PROMOTION CODES

"Promotion codes" are offered by third-party affiliates of the Stickley on Security Training Videos. If you choose to include a "Promotion Code" when placing your order, the affiliate who is associated with that promotional code will receive your organizations name. They will NOT however receive any other information related to your account. The sharing of the organization name only applies when a "Promotion Code" is included during the order process.

USE OF COOKIES

1. First-party cookies
User input cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session, or persistent cookies limited to the duration of an operation such as purchase or trial;
User identification persistent cookies, to identify the user visited the website for the first time;
Authentication cookies, to identify the user once he has logged in, for the duration of a session;
user interface customization cookies such as time zone and shopping cart status info, for the duration of a session (or slightly longer).

2. Third-party cookies
social plug in content sharing cookies, for logged in members of a social network;
Google Analytics cookies to generate statistical data on how the visitor uses the website.

How do we use them?
Where strictly necessary. These cookies and other technologies are essential in order to enable the Services to provide the feature you have requested, such as remembering you have logged in.

For functionality. These cookies and similar technologies remember choices you make such as time zone and shopping cart info. We use these cookies to provide you with an experience more appropriate with your selections and to make your use of the Services more tailored.

For performance and analytics. These cookies and similar technologies collect information on how users interact with the Services and enable us to improve how the Services operate. For example, we use Google Analytics cookies to help us understand how visitors arrive at and browse our products, services and website to identify areas for improvement such as navigation, user experience, and marketing campaigns.

Social media cookies. These cookies are used when you share information using a social media sharing button or .like. button on our websites or you link your account or engage with our content on or through a social media site. The social network will record that you have done this. This information may be linked to targeting/advertising activities.

How can you opt-out?
To opt-out of our use of cookies, you can instruct your browser, by changing its options, to stop accepting cookies or to prompt you before accepting a cookie from websites you visit. If you do not accept cookies, however, you may not be able to use our Services.

Updates to this Cookie Policy
This Cookie Policy may be updated from time to time. If we make any changes, we will notify you by revising the "effective starting" date at the top of this notice.

INFORMATION SECURITY AND CONFIDENTIALITY

We maintain physical, electronic and procedural safeguards to prevent the unauthorized release of or access to Your personal information. When We transfer and receive
certain types of sensitive information such as financial information, We redirect visitors to a secure server. We do not store or reuse Your credit card information. We do
not record or manager financial information about You (including credit card and other payment information). However, such precautions do not guarantee that this Site is
invulnerable to all security breaks. We make no warranty, guarantee, or representation that the use of this Site is protected from viruses, security threats, or other
vulnerabilities and that Your information will always be secure. We cannot guarantee the confidentiality of any communication or material transmitted to/from Us via the Site
or e-mail. Use of the Internet is solely at Your own risk and is subject to all applicable local, state, federal, and international laws and regulations.

THIRD PARTY PROCESSING

Stickley on Security uses the vendor Authorize.net to process all payment transactions. When making a purchase on this site, You also accept the Terms and Conditions and
Privacy Policy of Authorize.net.

CONTACT US

This Privacy Policy may be updated periodically and posted on this Site. It applies only to Our online practices and does not encompass other areas of the organization. We
reserve the right to change this Policy at any time by posting revisions. By accessing or using the Site, You agree to be bound by all of the Terms of this Privacy Policy as
posted at the time of Your access or use. We reserve the right to contact Users of the Site regarding changes to the Terms and Conditions generally, this Privacy Policy
specifically, or any other policies or agreements relevant to the Site's Users. If You have any questions about this Policy, You may email to:

Keep up with the latest cyber security news through our weekly Fraud News & Alerts updates.
Each week you will receive an email containing the latest cyber security news, tips and breach notifications.

Simply complete the form below and you're all set.

You're all set!

You will receive your first official security update email within the next week.
A welcome email has also just been sent to you. If you do not receive this email within the next few minutes, please check your Junk box or spam filter to confirm our emails are not being blocked.